On the topic of security I really hope they ship the game with security tokens available right at realease. If not we will see the inevetiable account hacks like the first period of Rift for instance before they got in under control.

I'd love to see a game just package one of those things with the box by default. I cant help but think that if bliz had included one with the cata box and made the things required to play a cata account they'd have a significant dropoff in hacked accounts. What GW1 did is they required you to have the name of one of your characters entered as a second layer of password. You only needed to enter this once and it would have the field prefilled on further logins so less chance of geting keyloged. They also did some form of IP tracking to determin if the account was loged in from a different location with a different computer. I once installed on my grandmothers computer over the holidays and got my GW account locked out for a few days cause they thought my account had been compromised.

I'd love to see a game just package one of those things with the box by default.

More important for GW2 is the effect it has on on-running costs. If you take away customer support obligations for hacked accounts, you'll get rid of probably 75% of customer service workload, and since GW2 isn't charging a monthly fee it's somewhat wise for them to cut overheads involved in day to day running of the game.

All I want is a digipass for my android.
I hate secret questions - I always forget them, always. Besides theyre annoying to type in anyway.
For all I care Id love it being shipped with an authenticator.
Having Auth/Digi pass being MANDATORY to even play the game.

Mandatory for the game(shipped with the game) is nice, though I'd like an digital version on itunes store as well.

Considering digital distribution of software is so common these days it would almost be mandatory to have a digital version available. At least some percentage of the population wont purchase a physical box so other than shiping the authenticator after the fact there'd be no way to get it to them.